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1. Introduction 


The central deterministic element of the aircraft conventional control systems is the pilot - 
operator. Such systems are called as active endogenous subjective systems, because (i) the 
actively used control inputs (ii) origin from inside elements (pilots) of the system as (iii) 
results of operators’ subjective decisions. The decisions depend on situation awareness, 
knowledge, practice and skills of pilot-operators. They may make decisions in situations 
characterized by a lack of information, human robust behaviors and their individual 
possibilities. These attributes as subjective factors have direct influences on the system 
characteristics, system quality and safety. 


Aircraft control containing human operator in loop can be characterized by subjective 
analysis and vehicle motion models. The general model of solving the control problems 
includes the passive (information, energy - like vehicle control system in its physical form) 
and active (physical, intellectual, psychophysiology, etc. behaviors of subjects - operators) 
resources. The decision-making is the appropriate selection of the required results leading to 
the best (effective, safety, etc.) solutions. 


This chapter defines the flight safety and investigates aircraft stochastic motion. It shows the 
disadvantages of the stochastic approximation and discusses, how, the methods of 
subjective analysis can be applied for the evaluation of flight safety. 


The applicability of the developed method of investigation will be demonstrated by analysis 
of the aircraft controlled landing. The applied equation of motions describes the motion of 
aircraft in vertical plane, only. The boundary constraints are defined for velocity, trajectory 
angle and altitude. The subjective factor is the ratio of required and available time to 
decision on the go-around. The decision depends on the available information and psycho- 
physiological condition of operator pilots and can be determined by the theory of statistical 
hypotheses. The endogenous dynamics of the given active system is modeled by a modified 
Lorenz attractor. 


2. Flight safety 
2.1 Definitions 


Safety is the condition of being safe; freedom from danger, risk, or injury. From the technical 
point of view, safety is a set of methods, rules, technologies applied to avoid the emergency 
situation caused by unwanted system uncertainties, errors or failures appearing randomly. 
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Safety and security are the twin brothers. The difference between them could be defined 
such as follows: 


- Safety: avoid emergency situation caused by unwanted system uncertainties, errors or 
failures appearing randomly. 

- Security: avoid emergency situations caused by unlawful acts (of unauthorized persons) 
- threats. 


Safety related investigations start as early as the development of the given system. At the 
definition and preliminary phase of a new system, one should also concentrate some efforts 
on the (i) potential safety problems, (ii) critical situations, (iii) critical system failures, (iv) 
and their possible classification, identification. After the risk assessment, the next step is the 
development of a set of policies and strategies to mitigate those risks. Generally, the safety 
policies and strategies are based on the synergy of the 


e physical safety (characteristics of the applied materials, structural solutions, system 
architecture that help to overcome safety critical - emergency situations), 

e technical safety (dedicated active or passive safety systems including e.g. sensors to 
enhance situation awareness), 

e non-technical safety (such as policy manuals, traffic rules, awareness and mitigation 
programs). 


The safety of any systems can be evaluated by using the risk analysis methods. Risk is the 
probability that an emergency situation occurs in the future, and which could also be 
avoided or mitigated, rather than present problems that must be immediately addressed. 


2.2 Flight safety metrics 


The evaluation of the flight safety is not a simple task. There is no uniformly applicable 
metrics for the evaluation. Some governments have already published (CASA, 2005; FAA, 
2006; Transport, 2007) their opinion and possible methodologies for flight safety measures 
that are applied by evaluators (Ropp & Dillmann, 2008). The problem is associated with the 
very complex character of flight safety depending on the developed and applied 


e safety plan with management commitment, 

e documentation management, 

e risk monitoring, 

e education and training, 

e safety assurance (quality management on safety), 
e emergency response plan. 


Risk analyses methods defining the probability of emergency situations or risks are very 
widely used for flight safety evaluation. Metrics of risk is the probability of the given risk as 
an unwanted danger event. This probability has at least four slightly different 
interpretations: 


e classic - the unwanted event, 

e logic - the necessary evil, 

e objective - relative frequency, 

e subjective - individual explanation of the events. 
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In practice, the analysis of accident statistics could characterize the flight risks. Such 
statistics give the evidences for the well-known facts (Rohacs, 1995, 2000; Statistical 2008): (i) 
the longest part of the flight (with about 50 - 80 % of flight time) is the cruise phase, which 
only accounts for 5 - 8 % of the total accidents and 6 - 10 % of the total fatal accidents, (ii) the 
most dangerous phases of flight are the take-off and landing, because during this about 2 % 
of flight time the 25 - 28 % of fatal accidents are occurring, and (iii) generally nearly 80 % of 
the accidents are caused by human factors and about 50 % of them are initiated by the pilots. 


A good example of using accident statistics is shown in Figure 1. Beside showing the effects 
of technological development on the reduction of flight risks, it also shows that since 2003, 
the European fatal accident rate - as fatalities per 10 million flights - has increased, without 
knowing - so far - the reason causing it. 
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Fig. 1. Characterization of the European accident statistics (EASA, 2008). 


The accident statistics could be also used for flight safety analysis in original, or unusual 
method. While accident statistics demonstrate a considerable higher risk, accident rates for 
small aircraft, according to the Figure 2., the ratio of all and fatal accidents are nearly the 
same for airlines and general aviation. This means that the small and larger civilian aircraft 
are developed, designed, and produced with the same philosophy, at least the same safety 
approach and ‘structural damping of damage processes’. The flight performances, flight 
dynamics, load conditions, structural solutions are different for small and larger aircraft, 
and therefore the accidents rates are also different. However, the risk of hard aftermath, 
appearing the fatal accident following the accidents are the same. 


2.3 Human factors 


In 1908, 80 % of licensed pilots were killed in flight accident (Flight, 2000). Since that, the 
World and the aviation have changed a lot. After 1945, the role of technical factors in 
causing the accidents (and generally in safe piloting) is continuously decreasing while the 
role of human factors is increasing. 


As it was outlined already, nearly 80 % of accidents are caused by human factors. (Rohacs, 
1995, 2000; Statistical, 2008). While, only 4 -7 % of accidents are defined by the "independent 
investigators" as accident caused by unknown factors. According to Ponomerenko (2000) 
this figure might be changed when one tries to establish the truth in fatal accidents, 
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All / fatal accident ratio 


1983 1988 1993 1998 2003 2008 


— Airliner —— General Aviation 


Fig. 2. An original way to compare airliner and GA accident statistics. 


especially by taking into account the socio-psychological aspects and use of “ ‘guilt’ and 
‘guilty’ as the ‘master key’ to unlock the true cause of the accident. Hence, the bias of the 
investigators often does not represent the interest of the victims, but that of the 
administrative superstructure. It side steps the legal and socio-psychological estimation of 
aircrew behavior, and replaces it by formal logic analysis of known rules: 
permitted / forbidden, man or machine, chance/ relationship, violated/not violated, etc.” 


Accident investigations show that human factors could be divided into three groups 
depending on their origins. 


e Technical factors: disharmony in human - machine interface. Most known cases from 
this group are called as PIDs (pilot induced oscillations). Some of these factors, like 
limitations of the control stick forces are included even into the airworthiness 
requirements. 

e Ergonomic factors: a lack of ergonomic information display, guidance control, out-of- 
cockpit visibility, design of instrument panel, as well as of adequate training 
[Ponomarenko 2000]. 

e Subjective factors: un-predictable and non-uniform man's behavior. Making wrong 
decisions because the lack of knowledge and practice of operators. 


The different groups have nearly the same role in accident casualty, equal to 25, 35, 40 %, 
respectively. Others (Lee, 2003) call the same type of factors as system data problems, 
human limitation and time related problems. 


The first group of human factors, harmonization of the man-machine interface from the 
technical side of view is well investigated and such type of human factors are taken into 
account in aircraft development and design processes. Generally, the handling quality or 
(nowadays) the car free characteristics are the merits and used as main philosophical 
approaches to solve these types of problems. 


The ergonomic factors have been investigated a lot for last 40 - 50 years. The third 
generation of the fighters had been developed with the use of ergonomics, especially in 
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development of the cockpit, that were radically redesigned for that period. However, the 
ergonomic investigations had used the governing idea, how to make better for operator. A 
new approach has developed for last 20 years that investigates the 'ergatic' systems (see for 
example Pavlov & Chepijenko, 2009) in which the operator (pilot) one of the important 
(might be most important) element of the systems, and the psycho-physiological behaviors 
of the operator may play determining roles in operation of system. 


The third group of human factors has not investigated on the required level yet. Generally, 
the key element of human reaction on the situation, especially on the emergency situation is 
the time. However, the speed and time of reaction is "... not determined by the amount of processed 
information, but by the choice of the signal’s importance, which is always subjective and affected by 
individual personality traits" (Ponomarenko 2000). In an emergency situation, flight safety does 
not depend as much on the detailed information on the emergency situation and the size of 
pilot supporting information, as on the whole picture including space and time, knowledge 
and practice of pilots and the actual determination of the ethical limits of man’s struggle 
with the arisen situation. 


Flight safety could also be analyzed with the prediction of the future air transport 
characteristics. For example, the NASA initiated zero accident project, (Commercial, 2000; 
Shin, 2000; White, 2009) leads to the following general conclusion: before introducing the 
wide-body aircraft, the risk of flight was decreased by a factor of 10, but this cannot be 
further reduced with the present technical and technological methods (Rohacs, 1998; Shin, 
2000). Even so, the number of aircraft and the number of yearly, daily flights are 
continuously increasing (Fig. 3.); Seeing this, the absolute number of accidents is expected to 
increase in the future, which might even lead to the vision made by Boeing, in which by 
2016/17, each week one large-body aircraft is envisioned to have an accident. "Given the 
very visible, damaging, and tragic effects of even a single major accident, this number of 
accidents would clearly have an unacceptable impact upon the public’s confidence in the 
aviation system and impede the anticipated growth of the commercial air-travel market" 
(Shin, 2000). Therefore, new methods like emergency management might need to be 
developed and applied to keep the absolute number of accidents on the present level. 


Seeing the envisioned rapid development of the future aviation, especially the small aircraft 
transportation system, the conclusion derived from the zero accident program and use of 
the subjective analysis in flight safety investigation might be relevant to be kept in mind. 
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Millions of departures 


Hull loss accident rate 


Fig. 3. The NASA zero accident program (Commercial, 2000). 
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3. Flight safety evaluation 
3.1 Technical approach to flight safety evaluation 


Technically, flight risks are always initiated by the deviations in the system parameters. 
Therefore, the investigation of the system parameter uncertainties and anomalies might be 
applied as a basis to evaluate flight safety. Flight safety is the risk that an emergency 
situation occurs, when the system parameters (at least one of them) are out of the tolerance 
zones. In the view of this, flight safety might be characterized by the probability of the 
deviations (in the structural and operational characteristics) being larger than those 
predetermined by the airworthiness (safety) requirements (Bezapasnostj 1988, Rohacs & 
Németh, 1997). 


Mathematically, flight operation quality, Q,(f), could be given in the following simple 


form: 
Q={a;} , i=1n (1) 


where a; are the parameters defining the attributes of the given aircraft or system. In a more 


general form, it could be given as: 


a; = f (Ay Ay 1 -Aj4 Ait 7Ay) è (2) 

In real flight situations, the real quality of operation Q,(t) is deviated from the design 
(nominal) quality Q” (t) : 

8 Q, (t)=Q.(t)-Qr (t) 6) 


For each case, the acceptable level of deviation is maximized by the flight safety threshold 
( Of ), 


JF Q (|2 ós > (4) 


where P (|6 Q, (t) 2 Os) describes the probability of a flight event (flight out of prescribed 
operational modes). 


By summing all the potential flight events, flight safety (Ps) could be given with the 
following probability: 


Pe =1- È R; (t)P.(t) (5) 


where R;(t) - is the risk of flight accident. 
For time period [0, T] the following integral risk can be applied: 
T 


È, =1-Ż |(1P,(£))dt . (6) 
0 
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Because 6Q,(t) is the random value with probability density, p (6 Q,(t)), the flight 


safety level can be given as: 
Ps = P(\5 Q (E| <s )= f 2 (6 Q,)ddQ, - (7) 
— fs 
According to the Tchebyshev inequality 
P((5 Q,(£)| > 55) < D(5 Q,) / ök 6) 
the flight safety level takes the form: 
P, = P(|5 Q, (|< 5;,)21-D(5 Q,)/ 5g (9) 
where D(ô Q,) is the dispersion of ô Q, . 


Such type of system approach was developed, applied and improved. Generally, once the 
aircraft is investigated as a dynamic system, the effects of the system anomalies could be 
given by the following type of probabilities (Rohacs 1986; Rohacs & Nemeth, 1997): 


P| y(t) 
Py} u(t) 


where y e R, defines the output (measurable) signal vector (measured vector of operational 
characteristics) x € R,, is the state vector, u € Rm gives the input (control) vector, z € R; 
stands for the vector of environmental characteristics (vector of service conditions), p € Rx is 
the parameter vector characterizing the state of the aircraft, t defines the time, r provides the 
elementary time, Q,, Qy, Q3, Qy, Qp are the allowed ranges for the given characteristics. 


(10.a) 


to <S £ < t+r, xeQ,, weQ,, ZEQ,, PEQ, | f 


(10.b) 


to <t < tT, xeQ,, yeQ,, ZEO, , PEQ, | 7 


If the joint density function, 


f = FLx(t),a(t),2(¢),p(t),¥(0)] (11) 
is known, then the recommended characteristics can be calculated as: 
Í fzdxdudzdpdy 


aPOgi 
f dy Í f:dxdudzdp 


(iex,u,z,p,y) (12.a) 
(j E€ x,u,z, p) 


-0 Q; 
Í fzdxdudzdpdy l 
P2fu(t) = Ol = = pee oa 
f du Í fzdxdzdpdy o 
eA Q. 


J 
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Unfortunately, this method of determining the effects of the system anomalies on the flight 
safety is often considered to be too complex, while it is found to be reasonable, since the 
formulas given above could be supported with statistical data collected during aircraft 
operation. The method of determining the flight risk on the probability approach (as given 
in (Gudkov & Lesakov, 1968; Howard, 1980)) is envisioned to be too complicated, once it is 
also desirable to consider the so-called common (failures appearing at the same time due to 
different reasons) and depending failures or errors. The Figures 4 and 5 show a nice 
example of using the described method is the investigation changes in geometrical and 
operational characteristics of aircraft investigated by (Rohacs 1986) and published in several 
articles, like (Rohacs, 1990). 


(mm) os st] a 


scattering of the values 664 anes ° ., 
measured during overhauls & ++ 3. Est. A 
{x— left-hand half-wing, e - ey— —_* —2= a 
right-hand half-wing, X and e - or — 

are the mean values, the lines i 

show the tolerance zones) 


fo tih) 


Fig. 4. The level book and examples of the measuring data for Mig-21. 
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Fig. 5. Probability of lack of generated lift at fighters Míg-21 due the changes in wing 
geometry during the operation (line - single seat, dot line - double seats aircraft) 
3.2 Stochastic model of flight risk 


The aircraft’s motion is the result of the deterministic control and the stochastic disturbance 
processes. Such motion might be mathematically given by the following stochastic (random) 
differential equation, called as diffusion process (Gardiner, 2004): 


x= f(x,t)+o(x,)n(t) , (13) 
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Naturally, this equation might be also given in vector form. The first part of the right side of 
the equation describes the drift (direction of the changes) of the stochastic process passing 
through x(t)=X at the moment t, while the second part shows the scattering (variance) of 
the random process. Here 7(t) is the random disturbance (e.g. air turbulence, or cumulative 
effects of random load processes, including even extreme loads as hard touchdown, etc.). 


Seeing that the future states depend only on the present sate, the equation (13) is in fact a 
Markov process (Ibe, 2008; Rohacs & Simon, 1989; Tihonov, 1977). Such process can be fully 
described by its transition probability density function: 


P(Xo,t2|X1,t1), (tg >t) , (14) 


which characterizes the distribution probability of the continuous random process (x(t)) at 
the moment t, once it’s passing through the x(t)=X at time t. 


The transition probability density function can be described by the following Fokker - 
Planck - Kolmogorov equations (Gardiner, 2004): 


Na). AT E 05h 8, I 


Oty Xa 
1 
or 
O(x, t) s= i ie t)p(x, ) 2 Zl or(x, t)p(x, t) |. (15.b) 
ôt Ox 2 dx? 


Statistic flight mechanics has already worked out several methods for the application of such 
models. For example, the statistical linearization through the proof of the sensitivity 
function matrix to the flight mechanic models and generating out the set of equations for the 
moments of the investigated stochastic process could be used to study the scattering of the 
process. 


Using the equations (15.a), (15.b), which define the Markov process, the following definition 
could be made: 


p(X, |X 4) = 2, P(x to|x, t)p(x, Xet (hath) (16) 
X(t 


This is called Chapman - Kolmogorov - Smoluchovski equation. It gives the possibility to 
approximate the investigated non-linear stochastic process with continuous time and state 
space with a Markov chain with continuous time and discrete state space. This leads us back 
to the situation chain process. 


The space of the motion variables can be divided into several subspaces, called as situations. The 
motion of the aircraft is in fact a time invariant series of situations. This is the situation dynamics. 
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Accidents are the results of the situation process, which is assumed to be similar to the one given 
in the Figure 6. Here, N marks the normal, conventional flight, S T S y S are different states related 
to the case when the aircraft has one (F1), two (F2), or three serious system failures (F,), while A 
shows the accident situation (Rohacs & Nemeth, 1997; Rohacs, 2000). 


Fig. 6. Simple graph model of aircraft pre-accident process 


The Markov chain can be described by the transition probabilities, 2; ;. These variables give 
the probability of moving the aircraft from a state (situation) S; to a state S;. As it is known, 
this type of process can be approximated by Markov process, under the following 
conditions: 


e the transition from one state into another occurs in a significantly short time, 

e the probability of a transfer from one state into another through one or more other 
states is a limited, and 

e the time spent in the states could be approximated by an exponential distribution. 


Under the conditions mentioned above, the process could be described with the following 
model: 


P(t)=P,(t)P(t), (17) 
where P(t)=[Pi(t)] is a vector of probabilities defining the states S; (i=N, F1, F2, F3, A). 


At this stage, one should give the applicable graph model and estimate the transition 
probability matrix. 


In this simple case, the aircrafts operational process - as a stochastic process with 
continuous time and discrete states shown in the Fig. 6. - could be approximated by the 
following Markov model: 


P(t) =B(t)P(t) (18) 


where P(t)=[P i(t)] is a vector of probabilities that the aircraft is in the states S; (i=N, F1, F2, 
F3, A), and 


B(t)=[B ij] (19) 
is a time depending transition matrix: 
By r1 By £2 By £3 Pn,a —Pri,Nn 0 0 0 
Py, FA Pein PrLE2 Pr1,63 Bria —Pr2,F3 0 0 
B(t) = PN £2 Pra,F2 -r21 ~ Pr2,F3 ~ Pr2,A —Prs,F2 0 
By 63 PELES PE2,F3 —Pr3,r2 - Br2,a —Ba.ps 
Pa Bria Broa Pr3,a Bars 
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Our theoretical and practical investigations on flight safety showed that the aircrafts 
operational process is a complicated process. For example, if a pilot reports an in-operating 
engine, than ATCOs are often to make 40 - 100 times more mistakes relative to normal 
circumstances. The simplified graph model of flight situations - taking into account such 
effects - is given in the Figure 7. The advantage of this representation method over the 
others, could be summarized in the followings. Firstly, this model includes a new state, 
called state of anomalies (An), in which the aircraft does not have any failures or errors, but 
still, its characteristics are essentially deviating from their nominal values. Secondly, the 
total amount of states are decomposed or grouped into four subparts (structure, pilot, air 
traffic control, surroundings). 


Fig. 7. The suggested general graph model of aircraft. 


To simplify the representation of this method, the Figure 7. shows only the nominal state 
decomposition (Rohacs & Nemeth, 1997; Rohacs, 2000). Even so, the different numbers of 
failures are further decomposed. States N is a prescribed nominal state. States An and F1 
might only be initiated by the anomalies or failures in one of the aircraft's flight operation 
subsystems (e.g. aircraft structure, pilot, ATC, surroundings). On the other hand, the states 
F2, F3 might be initiated by two or three failures appearing in any combination of the 
subsystems. For example F2 may contain mistake of the pilot and ATCO, or two aircraft 
structural (system) failures. 


According to these specific features of the model, the general Markov model should have 43 
states. For example in our model, the state number 21, is the state with two failures 
generated in the structure and one is initiated by the mistake of the pilot. As a consequence, 
the transfer matrix is composed of 43 x 43 elements, while the elements of the matrix are the 
linear functions of P(t): 


Bij = Bijo + Ki, P(t) ; (20) 


where, Bi,j,o is the initial transfer matrix element, Ki,j is the vector of coefficients. The vector 
Ki,j may contain zero elements, too, if the given state has no influence on transfer process. 


The determination of the vector elements Ki,j, is based on the theory of anomalies, dealing 
with the calculation of the real deviations, characteristics, and distributions. For example, 
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human error depends on weather, traffic situations, or possible system failures. Naturally, if 
the aircraft is piloted by pilot with limited skills, then the coefficients would be higher than 
it is for the conventional small aircraft operations. After the evaluation of different models 
based on the above discussed Markov and semi-Markov processes, we found that the 
inadequate initial data and the relatively large number of states makes the semi-Markov 
process irrelevant for our purposes. 


Due to the large number of states, the developed model might be seen too complex. On the 
other hand, by the analysis of the potential methods to simplify the model, it was found that 
the suggested approach can be transferred to the model shown in the Figure 7. This is 
reasonable, since from a flight safety point of view, the most important is the transfer of one 
state into another, and not the detail how that transfer could be made. Therefore, the 
transition matrix element, Br, Brz describing the transfer from one failure state (F1) into the 
state with two failures (F2) can be given in the following form: 


2 Bet,,2, Pry, 


Brrr. = 
ELF 2 7 
S Bam, £1, Pam 
k,i 


(21) 


where An indicates the state with anomalies, and k, i, j are indexes defining the states. 


1.2 


0.8-+ 


0.6+ 


0.4- 
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Fig. 8. Flight risk by considering (state An included - solid blue line ) or neglecting the 
effects of anomalies (green dashed line). 


As a result, the general model - describing the real interactions between different types of 
failures, distinguishing common and depending failures - could be reduced to a simple 
model. 


The developed model was used for the analysis of the aircraft control. Some results are 
shown in Figures 8. and 9. 
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Fig. 9. Probability of appearance of first failures (solid blue line - pilot error (failure), green 
dashed line - pilot error in case of system anomalies red dashed line - structure failure, blue 
dashed dot line - structure failure calculated considering the influences of the anomalies). 


4. Subjective analysis and flight safety 
4.1 Theoretical background 


The major determinative element of the aircraft’s conventional control systems is the pilot. 
Such systems are called as ergatic active endogenous systems [Kasyanov 2007], since the 
systems are actively controlled by solutions initiated by ergates (Greek épyatys ergatés - 
worker), human organism (e.g. nervous cells). So the control solution becomes from inside 
the system, from the operator. Such effects are called often as endogenous feedback or 
endogenous dynamics (Banos, Lamnabhi-Lagarrigue & Montoya, 2001; Fliens et all, 1999, 
Nieuwstadt 1997]. Because pilots make their decision upon their situation awareness, 
knowledge, practice and skills, e.g. on the subjective way, the system would be also 
subjective. Beside human robust behaviors and individual possibilities, pilots - in certain 
circumstances - should also make decisions, even if the information for an appropriate 
reaction is limited. 


Safety of active systems is determined by risks initiated by subjects being the central 
elements of the given system. For example, flight safety is the probability that a flight 
happens without an accident. Aircraft are moving in the three dimensional space, in 
function of their aerodynamic characteristics, flight dynamics, environmental stochastic 
disturbances (e.g. wind, air turbulence) and applied control. Pilots make decision upon their 
situation awareness. They must define the problem and choose the solution from their 
resources, which makes human controlled active systems endogenous. Resources are 
methods or technologies that can be applied to solve the problems (Kasyanov, 2007). These 
could be classified into the so-called (i) passive (finance, materials, information, energy - like 
aircraft control system in its physical form) and (ii) active (physical, intellectual, psycho- 
physiological behaviors, possibilities of subjects) resources. The passive resources are 
therefore the resources of the system (e.g. air transportation system, ATM, services 
provided), while the active resources are related to the pilot itself. Based on these, decision 
making is in fact the process of choosing the right resources that leads to an optimal 
solution. 
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Subjects (like pilots) could develop their active resources (or competences) with theoretical 
studies and practical lessons. However, the ability of choosing and using the right resources 
is highly depending on (i) the information support, (ii) the available time, (iii) the real 
knowledge, (iv) the way of thinking, and (v) the skills of the subject. Such decisions are the 
results of the subjective analysis. 


There is insufficient information on the physical, systematic, intellectual, physiological 
characteristics of the subjective analysis, as well as on the way of thinking, and making 
decision of subjects-operators like pilots. Only limited information is available on the time 
effects, possible damping the non-linear oscillations, the long-term memory, which makes 
the decision system chaotic. 


Flight safety can be evaluated by the combination of subjective analysis and aircraft motion 
models. 


At first, the pilot as subject (2) must identify and understand the problem or the situation 
(S), then from the set of accessible or possible devices, methods and factors (Sp) must 
choose the disposable resources ( RË ) available to solve the identified problems, to finally 
decide and apply the required resources (R™* ) (Kasyanov 2007) (Fig.10.). For this task, the 
pilot applies its active and passive resources. The active resources will define how the 
passive resources are used: 


Ray) (22) 


Fig. 10. Pilot decision - action process (endogenous dynamics) in aircraft operation (control) 
system. 


Instead of the function between the resources (22), the literature often uses the velocity of 
transferring the passive resources into the actives: 


oia = f,(v%4) 0%, (23) 
where 
dRt4 dR 

yed = NC yed — P , 24 
j dt p dt 24) 

and in simple cases 

_ 2R? 

f= aR" (25) 
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It is clear that the operational processes can be given by a series of situations: pilot identifies 
the situation (Si,), makes decision, controls ( R¥49 ), which transits the aircraft into the next 
situation (S;,). (The situation 5;, is one of the set of possible situations). This is a repeating 
process (Fig. 11.), in which the transition from one situation into another depends on (i) the 
evaluation (identification) of the given situation, (ii) the available resources, (iii) the 
appropriate decision of the pilot, (iv) the correct application of the active resources, (v) the 
limitation of the resources and (vi) the affecting disturbances. 


Fig. 11. Situation chain process of aircraft operational process as a result of an active 
subjective endogenous control. 


The situation chain process can be given by the following mathematical formula: 


c(t): (x0,to (ty [tpt tri R (to), R™ (ahe) l (26) 


or in a more general approach: 
c(t): (P(t) > 9; (ty € [toto +z] E Sp E Sa R”? (to), R" (to) +) (27) 


where x, is the vector of parameters at the initial (actually starting) state at tọ time; o gives 
the state of the system in the given time; r defines the available time for the transition of the 
state vector into the set of œ not later than [to, ty + | ; P are the problems how to transit the 
system from the initial state into the one of the possible state S, c S, not later than z. 


During a flight, one flight situation is followed by another. Therefore, the aircraft flight 
operational process with continuous state space and time can be approximated by the 
stochastic process with continuous time and discrete state space, flight situations. This 
means that a flight is a typical situation chain process. (This is a basis for using the stochastic 
model of flight risk - see 2.2. point.) 


4.2 Using the developed model to investigation of the aircraft landing 


Final approach and landing are the most dangerous phases of flights. It is even a more 
significant problem for personal flights, controlled by less-skilled pilots. 


The developed method using the subjective analysis to the flight safety evaluation was 
applied to investigate a landing procedure of a small aircraft. 


In this investigation, no side wing, and no lateral motion were considered. By using the 
trajectory reference system - in which the x axis shows the direction of the wind, z axis is 
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perpendicular to x in the local vertical plane, while centre of the coordinate system is located 
in the aircraft's centre of gravity - the motion of the aircraft could be given by the motion 
and the rotation of its center of gravity (Kasyanov 2004): 


mL =T(V,z,t)-Wsin0-D(V,z,t) ; (28.a) 
do 

mV ——-=L(V,z,t)-Weos6 A (28.b) 

I A M(a,4,V.24) : (28.c) 
” dt 


Due to the applied control, the trust (T), the lift (L), the drag (D) and the aerodynamic 
moment (M) are all clearly depending on time. The altitude (z) has also an influence on the 
variable above, through the ground effect. Mass (m) and therefore the weight (W) of the 
aircraft are assumed to be constant. The aircraft's velocity (V) and pitch rate (q) describes the 
motion, while the flight path angle (or descent angle @) gives the position of the aircraft. 
The angle of attack (a) is the difference between the pitch attitude, 2 and flight path 
angles: 


a=v-6. (29) 


The pitch rate and the modification of the altitude could be easily given by: 


dv 
=—, 30 
er (30) 
teint: (31) 
dt 


According to the flight operational manuals and airworthiness requirements, limitations (mi 
- minimum and ma - maximum) should be applied on the velocity, the descent angle and 
the decision altitude: 


Vel Vii Vina | (32.a) 
0 E| Onis Ona | (32.b) 
H > Hpi (32.c) 


A simple assumption could be applied: during an approach, pilots should decide whether to 
land or to make a go-around. For this decision they need time, which is the sum of (i) the 
time to understand and evaluate the given situation, o, , (ii) the time for decision making 
and (iii) the time to react (covering also the reaction time of the aircraft for the applied 
decision) (Kasyanov 2007): 
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PA = £10 (oy) + Het (Sa) + treet (Oksa) - 8) 


Here o, defines all possible situations (e.g. o, might be the situation of landing at first 
approach without any problems, o could be related to the situation when the under 
carriage system could not be opened, o} might stand for a landing on the fuselage, o; for 
go-around, or c, for a successful landing after second approach). 


S, is the chosen solution from the set of possible solutions. It is clear that all solutions have 
a limited drawback, such as extra cost, or extra fuel. 


The subjective factor of pilots might be introduced with the use of the ratio of the required 
and disposable resources (Kasyanov 2007): 


7 R" a _ prea a 
k= = ) = fk = d i) (34) 
RO (eK) EP) 
In this case, an endogenous index can be defined as 
F 41 o pred o,.)+ piec S, 
Erlo) = k s o or erlo) = ( x) ( ) , (35) 


1- a pP (o) = 47e4 (c) piP (o;) i 4% = p1 (o;) 


where t% (S,) is a time required to recognize the set of alternative strategies. 


Naturally, we can assume that pilots are able to evaluate the consequences of their decisions, 
and therefore they can evaluate the risk of the applied solutions. Such evaluation can be 


defined as the subjective probability of situations: P(o,), canonic distribution of which as 


the distribution of canonic assemble of the preferences is assumed to hold the following 
form: 


P (a, Je P(r) 


Zer 


p(ox)= (36) 


where p(o;) describes the distribution of the best alternatives from a negative point of view. 


The time-depending coefficients œ and f should be chosen in a way to model the 
endogenous dynamics, model the subjective psycho physiological personalities of pilots. 
The qualities of the pilots are depending on different factors including "periodical" 
incapacity to make decisions that increases while getting closer to the decision time 
(altitude) of go-around. 


prea (o) 
piP (o;) 


subjective probability, P(o,), only, and in case t, 1, the preference turn into zero. The 


The (36) has special features: in case of t, = — 0 preferences are determined by the 


(36 ) comes from the solution of the following function: 
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D, 7 -Yplo)ine(or) -AX plone (o) — aY p(ai)InP(o%) + Dror) . (37) 


A special feature of this function is that the structure of the efficiency function includes the 
logarithm of the subjective probability: 


7p -$ (ain P(o) + Be(o) (0%). (38) 


The complexity of decision making could be characterized by the uncertainties or the pilots' 
incapacity to make decisions, which is increasing while getting closer to the minimum 
decision altitude, H,,,,. To make decisions, the pilots must overcome their "entropic 
barrier", H,. The rate of incapacity could be defined with the norm of entropy: 


pa 39 

PIRN ` va 
Figure 12. shows a simplified decision making situation at an approach about the go-around 
[Kasyanov 2004, 2007]. At to,x9, S,:(o 1,0) indicates the set of alternative situations with 
the distribution of preferences ploi) and ploa) (where o; indicates the landing and o3 
defines the go-around). 


>03 
command: 


Fig. 12. Final phase of aircraft approach. 


The preferences are oscillating, because of the exogenous fluctuation (while decision altitude 
is getting closer) and the endogenous processes (depending on the uncertainties in the 
situation awareness and operators (pilots) incapacity to make decisions). If pilots are able to 
overcome their entropy barrier up to command for go-around (reaching the decision 
minimum altitude), £“, x” , then they could make a decision. Due to this decision, the set of 
situations, S, , can be given with the followings: 


Sat !(02); P(O2) = 1; p(o1) =0 


S, (o); plo) 
txt < Sa: (01); p(o) = 1; p(o2) =0 (#0) 


ploi)+ploz)=1 $24 


If pilots are not able to overcome their entropy barrier before reaching t,x , the flight 
situation would become more complex, and therefore the possibility to perform a go-around 
(case c, ) might be even out of the possible set of situations. 
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4.3 Modeling the human way of thinking and decision making 


A human as “biomotoric system” uses the information provided by sense organs (sight, 
hearing, balance, etc.) to determine the motoric actions (Zamora, 2004). From a piloting 
point of view, balance is the most important from the human sense organs. (As known, 
pilots are flying upon their ’botty” for sensing the aircraft’s real spatial position, orientation 
and motion dynamics (Rohacs, 2006).) The sense of balance (Zamora, 2004) is maintained by 
a complex interaction of visual inputs (the proprioceptive sensors being affected by gravity 
and stretch sensors found in muscles, skin, and joints), the inner ear vestibular system, and 
the central nervous system. Disturbances occurring in any part of the balance system, or 
even within the brain's integration of inputs, could cause dizziness or unsteadiness. 


In addition to this, human has another sensing, kinesthesia (Zamora, 2004) that is the precise 
awareness of muscle and joint movement that allows us to coordinate our muscles when we 
walk, talk, and use our hands. It is the sense of kinesthesia that enables us to touch the tip of 
our nose with our eyes closed or to know which part of the body we should scratch when 
we itch. This type of sensing is very important in controlling an aircraft and moving in 3D 
space. (Some scientists believe that future aircraft control system must be operated by 
thumbs, as the new generation is trained on video-games such as “Game Boy” (Rohacs, 
2006).) 


The main element of the “human biomotoric system” is the human brain that is the 
anteriormost part of the central nervous system in humans as well as the primary control 
center for the peripheral nervous system. 


The human brain (Russel, 1979; Davidmann, 1998). is a very complex system based on the 
net of brain cells called as neurons that specialize in communication. The brain contains 
circuits of interconnected neurons that pass information between themselves. 


The neurons contain the dendrites, cell body and axon. In neurons, information passes from 
dendrites through the cell body and down the axon (Russel, 1979; Davidmann, 1998). 


Principally, transmission of information through the neuron is an electrical process. The 
passage of a nerve impulse starts at a dendrite, it then travels through the cell body, down 
the axon to an axon terminal. Axon terminals lie close to the dendrites of neighboring 
neurons. 


From control theory point of view, the most important behavior of human brain is the 
memory, namely learning, memorizing and remembering (Receiving, Storing and 
Recalling). Generally, human beings are learning all the time, storing information and then 
recalling it when it is required (Davidmann, 1998). After the investigation of human 
thinking, including recognition, information analysis, reasoning, decision support (Rohacs, 
2006; 2007) the human way of thinking is found to be have the following behaviors: 


e syntactic and semantic processing of the sensed information, 

e working on the basis of large net of small and simplified articles (neurons), 

e using the complex system oriented approach, 

e making parallel thinking and activity, 

e learning (synthesis of the new knowledge), 

e model-formation and using the models (including verbal models applied in learning 
processes and complex mathematical representation), 

e long-term memory, 
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e tacit knowledge (took in practice), 

e intentional thinking (goal and wish), 

e intuition (subconscious thinking), 

e creativity (finding the contexts), 

e innovativity (making originally new minds, things), 
e unexpected values can be appeared, 

e jumping from quantity to quality. 


Seeing all the features listed above, it is clear that human thinking and decision making is a 
very complex process, containing some chaotic effects. 


There is not enough information on the physical, systematic, intellectual, psychophysiology, 
etc. characteristics of the subjective analysis, about the way of thinking and making decision 
of subjects-operators like pilots. Only limited information is available on the time effects, 
possible damping the non-linear oscillations, long term memory, etc. making the decision 
system chaotic. 


Professor Kasyanov introduced a special chaotic model (Kasyanov, 2007) based on the 
modified Lorenz attractor (Stogatz, 1994) for modeling the endogenous dynamics of the 
described process. 


= =a bZ-hX? + f(t); 

ay XZ+cX-mY?; (41) 
dt 

aZ 


= XY -dZ—nZ’. 
dt 


where a, b, c, d, h, m, n are the constants while f takes into account the disturbance. (In case of 
h=m=n=0 and f(t)=0 the model turns into the classic form of Lorenz attractor.) 


Principally, there are no strong arguments explaining the use of Lorenz attractor to model 
the human way of decision making (human thinking) (Dartnell, 2010; Krakovska, 2009), but 
the results of application are close to real situations. 


4.4 Results of investigations 


Professor Kasyanov investigated various model types, and evaluated the model parameters 
(Kasyanov, 2007). For a medium sized aircraft (weight of aircraft, W = 106 N; wing area, S = 
100 m2; wing aspect ratio A = 7; thrust T = 9.4 x 104 N; and velocity V = 70 m/sec) with 
commercial pilots, he recommended to use the following values: a=8; b=8; c=20; d.43; f=0.8; 
h= 0.065; m=0.065; n=0.065. 


Using these parameters, the subjective probabilities might be chosen as 
P(o,)=0.53, P(oy)=0.6 and ¢,=5.5+0.01t, @,=5.4+0.04t take into account the 
decreasing difference in the required and the available time for the decision. The typical 
results of using the described model are shown in the Figure 13., demonstrating the chaotic 
character of decision making. 


In this example, the figures demonstrate that pilots are unfixed for a period of about 10 sec, 
during which their preferences (A, B) are changing by sudden oscillations and the H 
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entropy at the beginning is rather high. If the limit for the entropy would be 0.7 (that is still 
quit high) then decisions could be made in about 10 sec. This means that pilots will not able 
to do that according to the Figure 12. 


If the parameters are set to a=10; b=10; c=35; d=1; f=0; h= 0.065; m=0.065; n=0.065 and 
P(o,)=0.53, P(c>)=0.6, then (see Figure 14) the entropy would quickly decrease and the 
decision could be made in about 3 sec. According to the ICAO requirements, time 
=i, -Ë (see Figure 12.) should not be less than 3.16 sec. Therefore, if the situation 
presented in the Figure 12. appears before tg, Xg, then the right decision could be made. 


2982x1077 4 ea 
5 0 s 
0 t 20 


Fig. 13. Results of using the developed model to landing of a medium sized aircraft. 
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Fig. 14. Results, when the parameters are chosen for well-skilled pilots. 
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From the results of using the developed model to the landing phase of a small aircraft (such 
as analyzed in the Hungarian national projects SafeFly: development of the innovative 
safety technologies for a 4 seats composite aircraft and EU FP7 project PPlane: Personal 
Plane: Assessment and Validation of Pioneering Concepts for Personal Air Transport 
Systems, Grant agreement no.233805) several important conclusions had been made (Rohacs 
et all, 2011; Rohacs & Kasyanov, 2011; Rohacs, 2010). 


During the final approach, the common airliner pilots require about three times more time 
for making decision on go-around than the well practiced colleagues. 


Using the developed model and condition defined by Figure 12, the descent velocity of a 
small aircraft could be determined to about 100 km/h for airliner common pilots, and 75 
km/h for those of less-skilled. 


In this case, the airport can be designed with a landing distance of less than 600 m (runway 
about 250 - 300 m) and a protected zone under the approach (to overfly the altitude of 100 
m) of about 1500 m. These characteristics enable to place small airports close / closer to the 
city center. 


5. Conclusions 


This chapter introduced the subjective analysis methodology into the investigation of the 
real flight situation, flight safety. The subject, as pilot operator generates his decision on the 
basis of his subjective situation analysis depending on the available information and his 
psycho-physiological condition. The subjective factor is the time available for the decision of 
the given tasks. 


After the general discussion on flight safety, its metrics and accident statistics, an original 
approach was introduced to study the role of human factors in flight safety. The 
deterministic or stochastic models of flight safety are not included clearly the subjective 
behaviors of human operators. However, the subjective analysis may open a new vision on 
the flight safety and may result to improve the aircraft development methods and tools. 


The subjective decision making of pilots was modeled by the modified Lorenz attractor that 
needs further investigation and explanation. The applicability of the developed 
methodology was applied to study the small aircraft final approach and landing. It 
demonstrates that the model is suitable to investigate the difference between the well 
trained and less-skilled pilots. The model helped in the definition of the aircraft and airport 
characteristics for the personal air transportation system. 


This work is connected to the scientific program of the "Development of the innovative safety 
technologies for a 4 seats composite aircraft - SafeFly" (NKTH-MAG ZRt. OM-000167/2008) 
supported by Hungarian National Development Office and Personal Plane - PPLANE Projhect 
supported by EU FPO7 (Contract No - 233805) and the research is supported by the Hungarian 
National New Széchenyi Plan (TAMOP-4.2.2/B-10/1-2010-0009) 
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